School Security SIMEX 20-6 After-Action Report (2Dec2020)

5m ago
3.23 MB
82 Pages

SIMEX 20-6 AFTER-ACTION REPORT: SCHOOLSECURITYDecember 2020SIMEX 20-6 After-Action ReportSchool SecurityDecember 2020UnclassifiedVersion 1.0UNCLASSIFIEDCISA DEFEND TODAY, SECURE m/company/[email protected] @cyber @uscert[email protected]

SIMEX 20-6 AFTER-ACTION REPORT: SCHOOL SECURITYEXECUTIVE SUMMARYSimulation Experiment (SIMEX) 20-6 was conducted from August 3 to August 14, 2020, to explore casualtymitigation during an active assailant event in a suburban high school in the United States through virtual realityexperimentation. The Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure SecurityAgency (CISA) sponsored this event in coordination with George Mason University’s (GMU) College of Educationand Human Development. The SIMEX modeled general school policies related to security during an activeshooter event, simulated those policies through repeated experimental runs in a virtual reality environment, andgenerated data to determine their impact on the outcome of a school shooting scenario. SIMEX participantsincluded teachers, students (played by GMU students simulating K-12 students), school resource officers (SRO),and a front office administrator.This SIMEX investigated the impact of three factors on an active shooter scenario: Factor 1 – Presence of SRO: Whether an SRO was present and patrolling in the school or absent.Factor 2 – Door-Locking Policy: Whether classroom doors were pre-locked or had to be manually lockedduring lockdown.Factor 3 – Lockdown Notification Policy: Whether lockdown notifications were decentralized (could bemade by teachers over public address system [PA]) or centralized (could only be issued by front office).One participant played the role of the shooter, who was a current student of the simulated school. The SIMEXincluded both targeted and mass casualty shooting scenarios to account for a variety of known anddocumented shooter behaviors.Experiment PurposeConducting this SIMEX 20-6 served two primary purposes. The first was to examine the above factors todevelop recommendations to improve both physical and operational security in K-12 schools across the nation.The second was to evaluate the SIMEX platform to determine if it is an effective tool to evaluate school safetyrelated policies, technologies, and procedures in the future. In addition to the key findings andrecommendations from this SIMEX, there are also documented takeaways that discuss the use of SIMEX as atool included at the end of this section.Experiment StructureFollowing three days of training and system testing, experimental trials ran August 6 to 14 with typically six runsa day in order to collect enough data to precisely measure the effects of the factors of interest. Each runconsisted of a participant briefing, setup, scenario execution, a post-run survey, and a post-run discussion.ScenarioThe SIMEX scenario was set in a virtual high school environment modeled after designs used in current dayschools supporting 1,000 students. To accommodate the relatively small number of live participants in theexperiment, just a section of the representative high school was modeled in the virtual environment usingarchitectural best practices for school design. Each run took place at 7:45 a.m. to simulate the period in theschool day involving school arrival and classroom transition activities.1Roles and AssignmentsThe simulated school was populated with 10 human-operated teachers and 20 human-operated students, aswell as more than 300 non-player character students to fill out the student body. A human-operated schooladministrator handled communications through the front office. In several of the runs, a human-operated SROpatrolled the school. Participants were recruited based on their real-world experience in these roles.At the scenario start, operators were instructed to perform actions that model a school morning. Ten of theclassrooms were designated homerooms. Each teacher was assigned to a homeroom, one teacher perhomeroom. Two human-operated students were also assigned to each one of these homerooms.1Determined from data indicating that three quarters of school shootings occur in the morning before or during classes. [9]UNCLASSIFIEDiicisa.govCISA DEFEND TODAY, SECURE y/[email protected] @cyber @uscert[email protected]

Commercial Routing AssistanceSIMEX 20-6 AFTER-ACTION REPORT: SCHOOL SECURITYPrior to a threat, students and teachers were given assignments to circulate around the school on the way totheir homerooms. During a threat, all participants were instructed to follow lockdown procedures as assembledfrom best practices of real school emergency procedures.For each run, the shooter’s mission was to either target a particular homeroom teacher or inflict as manyinjuries as possible. Analysis found that varying the shooter’s mission had no significant effect on scenariooutcomes in this experiment.Data Collection and AnalysisTo measure scenario outcomes, data was collected by automated event logging during the simulation as well asparticipant responses to post-run surveys. Quantitative measurements to evaluate each run included (but werenot limited to): Casualties as percentage of total populationPercentage of students “safe”—either evacuated or in a locked classroomAverage time for homerooms to complete lockdown (close and lock doors) and number of homeroomscompleting lockdownSituational awareness, workload, and stress as reported by the participants in post-run surveysIn addition to the quantitative metrics, qualitative data was collected in the form of survey content and wasanalyzed to explore participants’ attitudes and responses. SIMEX staff also observed the behavior of keyparticipants during scenario execution.FindingsFactor 1 Findings: Presence of an SROIn half of the experimental runs, a human-operated SRO patrolled the school. The following statisticallysignificant2 results emerged from this factor: On average, casualties were 7 percent of the total population when the SRO was present as opposed to13 percent when the SRO was absent.On average, the shooter discharged 52 percent of ammunition when the SRO was present as opposedto 91 percent when the SRO was absent.On average, 26 percent of students achieved safety when the SRO was present as opposed to 18percent when the SRO was absent.On average, 50 percent of homerooms (5/10) completed lockdown when the SRO was present asopposed to 30 percent (3/10) when the SRO was absent. In survey feedback teachers reported closingtheir doors when they saw the SRO was nearby.Factor 1 ConclusionThe presence of an SRO was found to have a significant impact on the outcome of an active school shooterevent. In runs with an SRO, more students got safely outside the school or into locked classrooms and therewere fewer casualties than in runs with no SRO.Factor 2 Findings: Door-Locking PolicyIn half of the experimental runs, classroom doors were “pre-locked,” meaning they were locked automaticallywhen closed. In the other runs, teachers had to manually lock doors by pressing a locking mechanism on theoutside of the door in the virtual environment for a randomized time between 3 and 6 seconds. The manuallock would not engage if the locking process was interrupted during this time. This mechanic was intended toemulate the time needed to operate a keychain and keylock or keypad lock while experiencing the stress of anactive shooter event in the school. The runs with pre-locked doors yielded the following statistically significantresults:Findings that are statistically significant refer to those in which it would be extremely unlikely for that effect to be due to chance.Based on an analysis of the experiment data, these are the findings that can be reported confidently.2UNCLASSIFIEDiiicisa.govCISA DEFEND TODAY, SECURE y/[email protected] @cyber @uscert[email protected]

Commercial Routing AssistanceSIMEX 20-6 AFTER-ACTION REPORT: SCHOOL SECURITY On average, 26 percent of students achieved safety when doors were pre-locked as opposed to 18percent when doors had to be manually locked.On average, 50 percent of homerooms completed lockdown when doors were pre-locked as opposed to30 percent when doors had to be manually locked.In survey and post-run feedback, teachers mentioned feeling frustrated and unsafe when faced withthe manual locks.On average, homerooms were locked 43 seconds before threat onset when doors were pre-locked asopposed to 15 seconds after threat onset when doors had to be manually locked. This difference isexplained by the observation that teachers closed their doors when they decided to start class, which inthe case of the pre-locked doors would lock them as well.Casualties were not significantly affected by door-locking policy in this experiment. Though morestudents were presumably safe behind locked doors, the shooter’s casualty count was similarly high inboth locking conditions. In this experiment, the shooter adopted a strategy of entering a classroom withthe weapon concealed before the door was closed and locked. If the shooter had adopted a differentstrategy, the increase in student safety may have led to a reduction in casualty count. In addition, a fewparticipants mentioned being shot by stray bullets through walls.Factor 2 ConclusionClassroom doors that lock without teacher intervention when closed were found to have a significant impact onthe outcome of an active school shooter event. In runs with pre-locked doors, more classrooms completedlockdown procedures and more students got safely outside the school or into locked classrooms.Factor 3 Findings: Lockdown Notification PolicyIn half of the experimental runs, lockdown notifications were “decentralized,” meaning that teachers could usethe PA system to alert the whole school of an active shooter incident taking place. The other runs were“centralized,” meaning that teachers reported the incident directly to the front office whereupon the schooladministrator made a formal notification of an active shooter event over the PA system. In both cases, the frontoffice administrator responded to teachers’ reports by issuing an official lockdown announcement over the PAsystem to the whole school. After the initial announcement, teachers continued to issue notifications on theshooter’s location and description using the PA system or to the front office, respectively. The quantitativemetrics did not indicate any significant effect of lockdown notification policy in this experiment. The followingare notable results regarding the lockdown notification process: The SRO reported consistently high situational awareness in runs with decentralized notifications(average Situational Awareness Rating Technique [SART]) score 35 as opposed to 29; SRO’s situationalawareness ranged from 23 to 38 over the course of the experiment).In post-run survey feedback and hotwash feedback for centralized runs, the SRO noted that informationin the notifications lagged behind the shooter’s actual location. Analysis of survey content showedteachers felt decentralized notifications were more reliable.In post-run survey feedback, the shooter described taking advantage of PA announcements to avoid theSRO and to surprise potential targets. This was confirmed by observing the shooter’s behavior.Factor 3 ConclusionAllowing teachers to give lockdown notifications over the PA system (the decentralized mode) did not have asignificant impact on the outcome of an active shooter event in this experiment.Related FindingsShooter and SRO InteractionThe shooter eliminated the SRO in 11 of the 12 runs in which the SRO was present. While this result was due insmall part to artificialities associated with the SRO’s inability to confront the shooter in a realistic way (e.g.,visual cues, non-lethal restraints), the shooter was generally able to target and eliminate the SRO before theSRO was able to engage the shooter.UNCLASSIFIEDivcisa.govCISA DEFEND TODAY, SECURE y/[email protected] @cyber @uscert[email protected]

Commercial Routing AssistanceSIMEX 20-6 AFTER-ACTION REPORT: SCHOOL SECURITYTwo trends emerge from the quantitative and qualitative analysis. The first is that the shooter’s situationalawareness is both timely and sufficient whereas the SRO’s situational awareness is both late and insufficient.The second is that the shooter’s mental workload is less than that of the SRO. Both of these indicatorscontribute to the success of the shooter over the SRO in direct confrontation.RecommendationsSchool security stakeholders should consider the following recommendations drawn from conclusions tomitigate the effects of school shootings. These recommendations are not prioritized (CISA does not recommendone recommendation over another) and it is critical that each be considered in accordance with state and/ordistrict requirements and regulations as well a school’s existing policies, procedures, and operations.Furthermore, the recommendations were developed based on data analysis evaluated within the scope of thespecific scenario described earlier in this section.1. The presence of an SRO in this experiment reduced casualties and increased the number of studentsable to remain safe during an active school shooter event. As a result, schools should consider the useof an SRO or equivalently trained security professional(s) as a component of a layered securityapproach.2. While an SRO’s presence improved the safety of students and teachers during lockdown, theirsituational awareness was not sufficient to neutralize the shooter in an active shooter incident. Toaddress this challenge, schools should investigate potential strategies or technologies that improve thetimeliness and accuracy of an SR